Electronic Apparatus and Control Method Thereof

This disclosure relates to an electronic apparatus and a control method thereof, and more particularly, to an electronic apparatus performing modular reduction and a control method thereof.

With the advancement in electronic technologies, various types of electronic apparatuses have been developed. In particular, as most communication technologies are advanced, technologies for encryption/decryption have been recently developed to secure information security.

As a message encrypted based on an encryption technology is delivered to a counterpart, the counterpart needs to perform decryption to use the message. In this case, the process of decrypting encrypted data may cause a waste of resources and time. Additionally, in the state where the message is decrypted temporarily for computation, the decrypted message may be exposed to hacking.

To solve the problem, research into homomorphic encryption has been conducted. The homomorphic encryption (HE) may obtain a result identical with a result that is encrypted after computation of a plaintext, although the computation is performed by using a ciphertext itself without decrypting encrypted information. In other words, the homomorphic encryption may involve various types of computation in the state where a ciphertext is not decrypted.

However, since the CKKS scheme cannot perform discrete computation directly, the CKKS scheme uses a polynomial approximation method, but there may be functions that are hardly polynomial-approximated. Accordingly, there is a problem that the CKKS scheme is limitedly operable only in a small range, and its performance significantly deteriorates with respect to big integers or in a wide real-number range.

According to one embodiment, an electronic apparatus may include memory storing instructions, and at least one processor including processing circuitry, the at least one processor configured to obtain a Cheon-Kim-Kim-Song (CKKS) ciphertext encoding a real-number message in a predetermined discrete value set, perform SlotToCoeff computation of converting the real-number message into a coefficient expression, perform, based on modulus switching computation with respect to the ciphertext converted into a coefficient expression, discretization of approximating the real-number message converted into a coefficient expression to a closest value in the predetermined discrete value set, perform modulus raising computation of raising modulus to an upper level with respect to the discretized ciphertext, perform CoeffToSlot computation of converting the ciphertext of which modulus is raised into a slot-encoded message, and perform, based on EvalMod computation, modular reduction at the same time as rebooting computation ends with respect to the slot-encoded ciphertext.

Additionally, the at least one processor may convert first modulus into second modulus lower than the first modulus with respect to the ciphertext converted into a coefficient expression, and restore the second modulus to the first modulus to perform discretization.

Additionally, the at least one processor may perform the discretization to obtain an output message in the predetermined discrete value set.

Additionally, the at least one processor may perform computation with respect to the output message through a look-up table without polynomial approximation at a time of additional function computation.

Additionally, the at least one processor may perform bit decomposition with respect to the output message to perform discrete function computation with respect to the output message.

Additionally, the electronic apparatus may further include a communication interface, and the at least one processor may control the communication interface to transmit the output message to a server.

Additionally, the electronic apparatus may further include a display, and the at least one processor may control the display to display the output message.

Further, a scaling factor of the real-number message may be maintained at a first modulus value while the modular reduction is performed.

Meanwhile, according to one embodiment, a control method of an electronic apparatus may include obtaining a Cheon-Kim-Kim-Song (CKKS) ciphertext encoding a real-number message in a predetermined discrete value set, performing SlotToCoeff computation of converting the real-number message into a coefficient expression, performing, based on modulus switching computation with respect to the ciphertext converted into a coefficient expression, discretization of approximating the real-number message converted into a coefficient expression to a closest value in the predetermined discrete value set, performing modulus raising computation of raising modulus to an upper level with respect to the discretized ciphertext, performing CoeffToSlot computation of converting the ciphertext of which modulus is raised into a slot-encoded message, and performing, based on EvalMod computation, modular reduction at the same time as rebooting computation ends with respect to the slot-encoded ciphertext.

Additionally, the performing discretization may include converting first modulus into second modulus lower than the first modulus with respect to the ciphertext converted into a coefficient expression, and restoring the second modulus to the first modulus to perform discretization.

Additionally, the method may further include performing the discretization to obtain an output message in the predetermined discrete value set.

Additionally, the method may further include performing computation with respect to the output message through a look-up table without polynomial approximation at a time of additional function computation.

Additionally, the method may further include performing bit decomposition with respect to the output message to perform discrete function computation with respect to the output message.

Additionally, the method may further include transmitting the output message to a server.

Additionally, the method may further include displaying the output message.

Further, scaling factor of the real-number message may be maintained at a first modulus value while the modular reduction is performed.

According to one embodiment, in a non-transitory computer-readable recording medium storing a program for executing an operation method of an electronic apparatus, the operation method may include obtaining a Cheon-Kim-Kim-Song (CKKS) ciphertext encoding a real-number message in a predetermined discrete value set, performing SlotToCoeff computation of converting the real-number message into a coefficient expression, performing, based on modulus switching computation with respect to the ciphertext converted into a coefficient expression, discretization of approximating the real-number message converted into a coefficient expression to a closest value in the predetermined discrete value set, performing modulus raising computation of raising modulus to an upper level with respect to the discretized ciphertext, performing CoeffToSlot computation of converting the ciphertext of which modulus is raised into a slot-encoded message, and performing, based on EvalMod computation, modular reduction at the same time as rebooting computation ends with respect to the slot-encoded ciphertext.

Hereafter, the subject matter of the present disclosure is described in detail with reference to the accompanying drawings.

General terms currently used as widely as possible are selected as the terms used to describe the embodiments of the disclosure considering functions in the disclosure, but may be changed based on the intention of those skilled in the art or a judicial precedent, the emergence of a new technology, or the like. Additionally, in a certain case, terms arbitrarily chosen by the applicant may be included in the terms used herein. In this case, the meanings of such terms are described in detail in corresponding descriptions of the disclosure. Accordingly, the terms used in the disclosure need to be defined based on the meanings thereof and particulars throughout the disclosure rather than the names thereof.

In the disclosure, the expression “have”, “may have”, “include”, “may include” or the like, indicates the existence of a corresponding feature (e.g., a numerical value, a function, an operation or an element such as a part and the like), and does not exclude the existence of an additional feature.

The expression of at least one from A or/and B is to be understood as indicating any one of “A” or “B” or “A and B”.

The expression “1st”, “2nd”, “first”, “second”, or the like, used in the disclosure, may be used to refer to various elements regardless of their order and/or importance, and may be used merely to differentiate one element from another but not intended to limit the elements.

In the disclosure, singular forms include plural forms as well, unless explicitly indicated otherwise. In the disclosure, the term “include,” “comprised of” or the like specifies the presence of stated features, numbers, steps, operations, elements, parts or combinations thereof, but does not imply the exclusion of the presence or addition of one or more other features, numbers, steps, operations, elements, parts or combinations thereof.

In the disclosure, the term user may refer to a person who uses an electronic apparatus or an apparatus (e.g., an artificial intelligence electronic apparatus) that uses an electronic apparatus.

Hereafter, various embodiments according to the disclosure are described in greater detail with reference to the accompanying drawings.

1 FIG. 1000 is a view provided to explain a structure of a network systemaccording to one embodiment.

1 FIG. 100 200 10 10 Referring to, an electronic apparatusand a servermay communicate with each other through a network. The networkmay be implemented as various types of wired/wireless communication networks, broadcast communication networks, optical communication networks, cloud networks and the like, and each of the devices may also be connected based on methods such as Wi-Fi, Bluetooth, Near Field Communication (NFC) and the like, without a separate medium.

1 FIG. 100 100 100 100 illustrates one electronic apparatus, but the electronic apparatusmay be implemented in various different forms. As one example, the electronic apparatusmay be various types of apparatuses such as a smartphone, a tablet, a PC, a laptop PC, a home server, a kiosk, a game console, a camera and the like. In addition, the electronic apparatusmay also be implemented in the form of a home appliance to which IoT functions are applied.

100 100 1 100 100 1 1 1 As one example, in the case where the electronic apparatusis provided with a camera, the electronic apparatusmay capture an image of at least one original datadirectly and obtain the image. In the case where the electronic apparatusis provided with no camera, the electronic apparatusmay receive original datathrough various types of wired or wireless interfaces from an external device (e.g., a camera, a memory stick and the like) and store the original data. In the embodiments of the disclosure, the original datamay be a photo image, but not necessarily limited thereto, and may be a graphic image. Alternatively, the original datamay be video contents including a plurality of image frames.

100 2 200 10 The electronic apparatusmay perform homomorphic encryptionwith respect to at least one original data, obtain a homomorphic ciphertext, and then transmit the homomorphic ciphertext to the serverthrough the network.

1 200 In this case, the leakage of the original datamay be caused due to hacking, or by a manager of the server, in the process of transmission. However, in the case where the original data are transmitted in the form of a homomorphic ciphertext, the original data may not be identified despite the leakage of the original data. Accordingly, security associated with the user's personal information or physical feature may improve.

A homomorphic encryption algorithm generating a homomorphic ciphertext may vary, but in the embodiments of the disclosure, performing homomorphic encryption by using a CKKS scheme or a CKKS scheme-based modified algorithm is described.

100 1 To transmit the original data in the form of a homomorphic ciphertext, the electronic apparatusmay perform encoding. In the case of homomorphic encryption, encoding may be a task of converting data into an encryptable form. Since homomorphic encryption is based on a mathematical structure (e.g., poilynomial computation), the homomorphic encryption algorithm may convert the original datato a processible form, and then perform homomorphic encryption of the original data.

In the homomorphic encryption, slot encoding and coefficient encoding may be ordinarily used.

The slot encoding is a method by which data to be encrypted are allocated to a plurality of slots, and then encrypted based on a total slot unit. The slot may mean a unit of data that can be stored in parallel in one homomorphic ciphertext. In the case where a ciphertext is expressed in the form of a polynomial, coefficients or roots of the polynomial may function as each slot. If one ciphertext is comprised of a total of n numbers of slots, n numbers of values may be encrypted or computed at the same time. In other words, as slot encoding is performed, parallel computation with respect to a homomorphic ciphertext may be performed. The slot encoding method may vary depending on a homomorphic encryption algorithm. The above-described CKKS scheme may perform slot encoding by using Fast Fourier Transform (FFT).

The coefficient encoding is a method by which data to be encrypted is converted in the form of a polynomial, and coefficients of the polynomial are converted into encrypted values. The above-described CKKS scheme may perform coefficient encoding by using Discrete Fourier Transform (DFT).

200 100 200 The serveris a device for providing a result of encryption computation by performing computation in the state where a homomorphic ciphertext (i.e., at least one original data homomorphically encrypted) provided from the electronic apparatusis homomorphically encrypted. The servermay be implemented in various different forms such as a web server, a cloud server and the like.

200 221 221 In the server, an AI modelfor performing computation in an encryption state may be stored. In the case where original data are provided and computation based on the original data is permed as described above, the AI modelmay be a convolutional neural network (CNN), but not necessarily limited thereto.

221 In detail, the AI modelmay perform various types of computation with respect to a homomorphic ciphertext encrypted with a homomorphic encryption (e.g., a CKKS scheme) technology, and output a result of the computation in the form of a homomorphic ciphertext. Hereafter, a computation result output in the form of a homomorphic ciphertext is referred to as an encryption computation result.

221 221 200 100 In the case where the AI modelis comprised of a CNN, the AI modelof the servermay perform convolution computation with respect to each depth or convolution computation by using a model parameter with respect to a homomorphic ciphertext transmitted from the electronic apparatus. Such a computation method is described hereafter in detail.

200 100 100 100 3 4 100 The servermay transmit an encryption computation result to the electronic apparatusthrough the network. The electronic apparatusmay decryptthe received encryption computation result, and provide a result of the computationto the user. A method of providing the result may vary depending on the sort and configuration of electronic apparatus.

100 100 4 As one example, in the case where the electronic apparatusis provided with a built-in display or connected with an externa display (e.g., a monitor), the electronic apparatusmay display a decrypted computation result.

100 100 As one example, in the case where the electronic apparatusis provided with a speaker, the electronic apparatusmay also output a voice message corresponding to a computation result through the speaker.

100 100 As one example, in the case where the electronic apparatuscommunicates with another terminal device (e.g., a smartphone and the like), the electronic apparatusmay also transmit a decrypted computation result to the terminal device.

221 1 As one example, in the case where the AI modelis a model trained to diagnose whether there is a disease, a computation result may include information as to where there is a disease, information on the sort of disease, information on the progress of a disease and the like that are diagnosed based on original dataof the user.

2 FIG. 2000 is a view provided to explain a structure of a network systemaccording to one embodiment.

2 FIG. 100 1 100 200 300 10 n Referring to, the network system may include a plurality of electronic apparatuses---, a first server, and a second server, and each of the elements may be connected with one another through a network.

10 The networkmay be implemented as various types of wired/wireless communication networks, broadcast communication networks, optical communication networks, cloud networks and the like, and each of the devices may also be connected based on methods such as Wi-Fi, Bluetooth, Near Field Communication (NFC) and the like, without a separate medium.

2 FIG. 100 1 100 100 1 100 n n illustrates a plurality of electronic apparatuses---, but the plurality of electronic apparatuses may not be necessarily used, and one electronic apparatus may be used. As one example, the electronic apparatuses---may be implemented as various types of apparatuses such as a smartphone, a tablet, a game console, a PC, a laptop PC, a home server, a kiosk, and the like, and in addition, may also be implemented in the form of a home appliance to which IoT functions are applied.

100 1 100 100 1 100 200 300 200 n n 2 FIG. The user may input various types of information through the electronic apparatuses---used by the user. The input information may be stored in the electronic apparatuses---themselves, but may be transmitted to an external device and stored in the external device for the reasons of storage capacity and security and the like. In, the first servermay play a role in storing the information, while the second servermay play a role in using all or part of the information stored in the first server.

100 1 100 200 n Each of the electronic apparatuses---may homomorphically encrypt the input information and transmit a homomorphic ciphertext to the first server.

100 1 100 100 1 100 n n Each of the electronic apparatuses---may have cryptographic noise, i.e., an error, produced in the process of homomorphic encryption, included in the ciphertext. Specifically, the homomorphic ciphertext generated in each of the electronic apparatuses---may be generated in the way that a resultant value including a message and an error value is restored at a time when decryption is performed by using a secret key later.

100 1 100 n As one example, the homomorphic ciphertext generated in the electronic apparatuses---may be generated in the way that the following features are satisfied at a time when decryption is performed by using a secret key.

Herein, <, > means a usual inner product, ct means a ciphertext, sk means a secret key, M means a plaintext message, e means an encryption error value, and mod q means modulus of a ciphertext. Herein, q needs to be selected as a value greater than M that is a resultant value calculated by multiplying the message by a scaling factor Δ. In the case where an absolute value of error value e is sufficiently less than M, a decryption value M+e of the ciphertext is a value that may replace an original message with precision in significant figure arithmetic. An error in decrypted data may be disposed to the least significant bit (LSB), while M may be disposed to the second least significant bit.

In the case where the size of the message is too small or big, the size may be adjusted by using the scaling factor. In the case of use of a scaling factor, a real number-type message as well as an integer-type message may be encrypted, thereby enhancing availability significantly. Additionally, since the size of the message is adjusted by using the scaling factor, the size of an area where messages are present, i.e., an effective area, in a ciphertext after the performance of computation, may also be adjusted.

L According to the embodiment, the ciphertext modulus q may be set in various different forms, for use. As one example, the modulus of the ciphertext may be set in the form of q=Δ(scaling factor Δ to the power of exponent). In the case where Δ is two, the modulus of the ciphertext may be set to a value such as q=210.

Additionally, the homomorphic ciphertext according to the disclosure is described under the assumption that a fixed point is used, but may be applied even in the case where a floating point is used.

200 The first servermay store a received homomorphic ciphertext in a ciphertext state, without decrypting the ciphertext.

300 200 200 300 300 The second servermay request a specific processing result of the homomorphic ciphertext from the first server. The first servermay perform specific computation at the request of the second server, and then transmit a result of the computation to the second server.

100 1 100 2 200 300 100 1 100 2 200 200 300 As one example, in the case where ciphertexts ct1, ct2 transmitted by two electronic apparatuses-,-are stored in the first server, and the second servermay request a value calculated by adding data provided from the two electronic apparatuses-,-from the first server. The first servermay perform computation of adding two ciphertexts at the request of the second server, and then transmit a resultant value ct1+ct2 of the computation to the second server.

200 Considering the attributes of the homomorphic ciphertext, the first severmay perform computation in the state where decryption is not performed, and a resultant value of the computation may also be formed into a ciphertext. In the disclosure, a resultant value obtained based on computation is referred to as a ciphertext.

200 300 300 The first servermay transmit the computation result ciphertext to the second server. The second servermay decrypt the received computation result ciphertext, to obtain a resultant value of computation of data included in each of the homomorphic ciphertexts.

100 Accordingly, the electronicmay perform efficient multiplication computation while minimizing the number of RNS moduli, thereby enabling rapid computation of a homomorphic ciphertext.

2 FIG. Meanwhile, in, first and second electronic apparatuses performing encryption, and the second server performing decryption are illustrated, but not limited thereto.

3 FIG. 100 is a block diagram illustrating a configuration of an electronic apparatusaccording to one embodiment.

3 FIG. 100 110 120 120 Referring to, an electronic apparatusincludes memorystoring instructions and at least one processor. The at least one processormay execute instructions to perform a following operation.

110 120 110 The memorymay refer to hardware storing information such as data and the like in the form of electricity or magnetism, such that the processorand the like may access the information. To this end, the memorymay be implemented as at least one hardware out of non-volatile memory, volatile memory, flash memory, hard disk drive (HDD), or solid state drive (SSD), RAM, ROM and the like.

110 100 120 100 120 110 120 120 In the memory, at least one instruction required for operations of the electronic apparatusor the processormay be stored. Herein, the instruction, as a symbol (sign) unit indicating the operations of the electronic apparatusor the processor, may be drawn up in mechanical language as language understandable by a computer. Alternatively, in the memory, a plurality of instructions for performing specific tasks of the electronic apparatusor the processormay be stored as an instructions set.

110 110 In the memory, data as information of a bit unit or a byte unit, which may indicate letters, numbers, videos and the like, may be stored. For example, in the memory, data as an encryption target, encrypted data and the like may be stored.

110 120 120 The memorymay be accessed by the processor, and the processormay perform reading/recording/correcting/deleting/updating and the like of an instruction, an instruction set, or data.

120 100 120 100 100 120 110 100 The processorcontrols the operations of the electronic apparatusentirely. Specifically, the processormay be connected with each of the elements of the electronic apparatusto control the operations of the electronic apparatusentirely. For example, the processormay be connected to the elements such as memoryand the like, to control the operations of the electronic apparatus.

120 120 100 120 110 120 110 The one or more processorsmay include one or more of a central processing unit (CPU), a graphics processing unit (GPU), an accelerated processing unit (APU), many integrated core (MIC), a neural processing unit (NPU), a hardware accelerator or a machine learning accelerator. The one or more processorsmay control one among other elements of the electronic apparatusor any combination thereof, and perform an operation in association with communication or data processing. The one or more processorsmay execute one or more programs or instructions stored in the memory. For example, the one or more processorsmay perform a method according to one embodiment, by executing one or more instructions stored in the memory.

In the case where the method according to one embodiment includes a plurality of operations, the plurality of operations may be performed by one processor, or by a plurality of processors. For example, when a first operation, a second operation, and a third operation are performed based on the method according to one embodiment, the first operation, the second operation and the third operation may all be performed by a first processor, or the first operation and the second operation may be performed by the first processor (e.g., a general-purpose processor), while the third operation may be performed by a second processor (e.g., an AI-exclusive processor).

120 120 The one or more processorsmay be implemented as a single core processor including one core, or one or more multicore processors including a plurality of cores (e.g., a homogeneous multi core or a heterogeneous multi core). In the case where the one or more processorsare implemented as a multicore processor, each of the plurality of cores included in the multicore processor may include processor internal memory such as cache memory, and on-chip memory, and common cache shared by the plurality of cores may be included in the multicore processor. Additionally, each of the plurality of cores (or part of the plurality of cores) included in the multicore processor may read and perform a program instruction for implementing the method according to one embodiment independently or in the way that all (or part) of the plurality of cores are associated.

In the case where the method according to one embodiment includes a plurality of operations, the plurality of operations may be performed by one of the plurality of cores included in the multicore processor or performed by the plurality of cores included in the multicore processor. For example, when a first operation, a second operation, and a third operation are performed based on the method according to one embodiment, the first operation, the second operation and the third operation may all be performed by a first core included in the multicore processor, or the first operation and the second operation may be performed by the first core included in the multicore processor, while the third operation may be performed by a second core included in the multicore processor.

120 120 100 In the embodiments of the disclosure, the one or more processorsmay mean a system on a chip (SoC) where one or more processors and other electronic components are integrated, a single core processor, a multicore processor, or a core included in a single core processor or a multicore processor, and herein, the core may be implemented as a CPU, a GPU, an APU, a MIC, a NPU, a hardware accelerator, or a machine learning accelerator, and the like, but embodiments thereof may not be limited thereto. Hereafter, the expression processoris used to describe the operations of the electronic apparatusfor convenience of description.

120 The processormay obtain a Cheon-Kim-Kim-Song (CKKS) ciphertext in which a real number-message in a predetermined discrete value set is encrypted, perform SlotToCoeff computation of converting the real number-message into a coefficient expression, perform discretization of approximating the real number-message converted into the coefficient expression to a closest value of the predetermined discrete value set, based on modulus switching computation with respect to the ciphertext converted into the coefficient expression, perform modulus raising computation of raising the modulus to an upper level with respect to a discretized ciphertext, perform CoeffToSlot computation of converting the ciphertext of which the modulus is raised into a slot encoded message, and perform modular reduction at the same time as rebooting computation with respect to the slot encoded ciphertext based on EvalMod computation ends.

120 120 That is, the processormay perform modular reduction without existing polynomial approximation as a discretization operation is performed additionally. Additionally, based on modulus switching computation, the processormay round off the real number-message such that the real number-message may correspond to the predetermined discrete value set and convert the real umber-message into a discrete CKKS ciphertext. Then the modular reduction is performed based on CoeffToSlot computation and EvalMod computation, at the same time as bootstrapping is performed, thereby securing computation efficiency.

Additionally, the subject matter of the disclosure may be operated with constant complexity regardless of the size of a message unlike a conventional one, and may secure high performance despite a big (wide) input range. Accordingly, the subject matter of the disclosure may effectively solve problems such as a degree explosion, or a precision loss that occurs in a conventional approximation-based method.

120 Meanwhile, a scaling factor of the real number-message may be maintained at a first modulus value, while the modular reduction is performed. In other words, since the scaling factor remains the same as a base modulus, modular reduction computation may be performed reliably. A gap between modulus and a scale is required in the case of conventional CKKS, but the processormay perform modular reduction and bootstrapping without a gap.

Accordingly, computation efficiency may be enhanced, an unnecessary precision loss may be prevented, and a calculation resource may be saved.

120 The processormay convert a first modulus into a second modulus lower than the first modulus with respect to the ciphertext converted into a coefficient expression, and restore the second modulus to the first modulus to perform discretization.

120 120 That is, the processormay apply modulus switching two consecutive times. For example, the processormay map the real number-message converted into a coefficient expression in a specific discrete lattice while converting the first modulus into the second modulus lower than the first modulus, and restore the second modulus to the first modulus again to normalize the real number-message to a closest discrete value.

This is enabled only after the real number-message is converted into a coefficient expression based on SlotToCoeff computation, and accordingly, the advantages of discrete CKKS computation may be applied to an ordinary CKKS ciphertext.

120 120 The processormay perform discretization to obtain an output message in the predetermined discrete value set. For example, the processormay obtain an output message of a finite set such as {0, 1/32, . . . , 31/32} based on discretization. In other words, the advantages of discrete CKKS may be used through the message, while polynomial interpolation or lookup table-based computation may be enabled.

In particular, sign, abs, max functions and the like hardly approximated with a polynomial may be processed efficiently based on a LUT-based approach.

120 120 The processormay perform computation with respect to the output message through a look-up table without polynomial approximation at a time of additional function computation. In other words, since the output message belongs to the finite set, the processormay configure an accurate LUT with respect to any function, and based on the LUT, perform computation.

For example, in existing CKKS, functions such as ReLU, exp, sqrt and the like need to be approximated with a high-degree polynomial, but in the case where the discrete CKKS or LUT method is used, the functions may be calculated efficiently and reliably.

120 The processormay perform bit decomposition with respect to the output message, to perform discrete function computation with respect to the output message.

The bit decomposition may enable higher-degree computation such as comparison, argmax, sorting and the like in discrete CKKS, and an existing polynomial approximation method requires very deep circuitry and large calculation costs, while the bit decomposition enables such computation to be performed without complexity and with efficiency.

For example, in the case where the bit decomposition is used, the speed of computation performance may be faster up to a maximum of seven times than conventional, and the probability of failure may be reduced to a level almost close to zero.

100 120 120 The electronic apparatusmay further include a communication interface, and the processormay control the communication interface to transmit an output message to a server. Since the output message is in the state where homomorphic computation is applied to the output message, the processormay transmit the output message reliably to the server through the communication interface. Accordingly, present disclosure may be useful in an environment where resources are limited such as an IoT device, a mobile device and the like.

The server may preform additional computation or tally processing based on the received output message, and data may be in an encryption state, thereby ensuring security and privacy.

100 Herein, the communication interface is an element performing communication with various types of external devices based on various communication methods. For example, the electronic apparatusmay perform communication with the server through the communication interface.

The communication interface may include a Wi-Fi module, a Bluetooth module, an infrared communication module and a wireless communication module and the like. Herein, each of the communication modules may be implemented in the form of at least one hardware chip.

The Wi-Fi module, and the Bluetooth module perform communication based on a Wi-Fi method and a Bluetooth method respectively. In the case where the Wi-Fi module or the Bluetooth module are used, the Wi-Fi module and the Bluetooth module may perform communication respectively based on a Wi-Fi method and a Bluetooth method. In the case where the Wi-Fi module or the Bluetooth module is used, various types of connection information such as a service set identifier (SSID), a session key and the like may be first transmitted and received, and are used to perform communication connection and then transmit and receive various types of information. The infrared communication module performs communication based on an infrared Data Association (IrDA) communication technology which transmits data wirelessly over a short distance by using infrared rays between visible light and millimeter waves.

The wireless communication module may include at least one communication chip that performs communication according to various wireless communication standards such as Zigbee, 3rd Generation (3G), 3rd Generation Partnership Project (3GPP), Long Term Evolution (LTE), LTE Advanced (LTE-A), 4th Generation (4G), 5th Generation (5G) and the like, in addition to the above-described communication methods.

Alternatively, the communication interface may include a wired communication interface such as a high definition multimedia interface (HDMI), display port (DP), Thunderbolt, universal serial bus (USB), red green blue (RGB), D-subminiature (D-SUB), and digital visual interface (DVI) and the like.

Another communication interface may also include at least one among wired communication modules that perform communication by using a local area network (LAN) module, an Ethernet module, or pair cables, coaxial cables, or fiber optic cables and the like.

100 120 120 120 The electronic apparatusmay further include a display, and the processormay control the display to display an output message. For example, the processormay convert the output message into a form that can be checked by the user directly, and control the display to display the converted output message. For example, the processormay provide sensitive information such as medical data or a personalized analysis result to the user as visual data in the state where the sensitive information is processed reliably.

Such a method may have an advantage of ensuring an immediate check of a result at a local device, and may enhance user experience while securing improvement in data privacy.

100 The electronic apparatus, as described above, may perform modular reduction regardless of an input range, by overcoming a limitation in an existing polynomial approximation method, and accordingly, may support efficient discrete function computation and machine learning computation.

100 4 17 FIGS.- 4 17 FIGS.- 4 17 FIGS.- Hereafter, the operations of the electronic apparatusare described in greater detail with reference to. In, individual embodiments are described for convenience of description. However, the individual embodiments ofmay also be implemented in any combination.

Among fully homomorphic encryption (FHE) methods, the Cheon-Kim-Kim-Song (CKKS) method [CKKS17] may efficiently provide real number-calculation necessary for various applications such as machine learning. For example, the CKKS may provide a function called rescaling, and the rescaling may be a function of approximately dividing a message by a constant. However, the rescaling may prevent the CKKS from supporting intrinsic modular reduction performed in other main methods (BGV [BGV12], BFV [Bra12, FV12], CGGI [CGGI16], DM [DM15]). Accordingly, the CKKS may process discrete computation (e.g., comparison such as [CKK+19, CKK20, LLKN22, LLKN22]) based on polynomial approximation, but result in relatively low performance.

q q N In the disclosure, efficient discrete computation for the CKKS may be provided by using an inherent modular reduction function in=[X]/(X+1). In the case of a conventional CKKS, modular reduction may be used in rescaling and ModRaise computation, and in some studies [KDE+24, CCKS23], modular reduction may be partially used to design a new function in the case of CKKS, but research into the effect of modular reduction is not enough. In the disclosure, modular reduction is integrated as part of basic CKKS computation, and the integrated one is used to process discrete calculation.

N Q >0 Q Q q In the case of=[X]/(X+1),=/Qwhen integer N as powers of 2 and Q∈are given, modular reduction inmay be inherent. In other words, in the case of q|Q and p(X)∈, [p(X)]may be defined as taking each coefficient q as modulus. In the case where coefficient-encoding RLWE ciphertext

is given, and this decrypts m∈, the following may be defined.

q This may be decrypted to [m].

However, in conventional CKKS, modular reduction may be used in a limited manner. For example, a CKKS ciphertext is usually in a slot-encoding state, and this is because this is not compatible with modular reduction, and the ciphertext may be in the coefficient-encoding state right over the lowest modulus, immediately before the ModRaise step in the bootstrapping context. Additionally, if decryption is not immediately preformed right after modular reduction, an output of the modular reduction may require bootstrapping for more calculations. However, since a message has a ciphertext having no gap with modulus, bootstrapping may hardly be performed. Existing CKKS bootstrapping (suggested for the first time in [CHK+18]) may calculate approximate modular reduction for removing base modulus of small multiples only in the case where there is a gap between a message and modulus.

120 120 The processormay integrate bootstrapping into modular reduction, and use most significant bit (MSB) bootstrapping. For example, the processormay perform bootstrapping each time modular reduction is required, but this may be more excellent than a typical approximation-based method. In the case of MSB bootstrapping, a coefficient-encoding method in [BKSS24] may be adopted, and may be expanded through an iterative algorithm. Hereafter, a MSB bootstrapping framework with respect to discrete data is described, and then variants for real-number data and approximate data are described.

An iterative MSB bootstrapping method may be a method of expanding a MSB bootstrapping method in [BGGJ20, BKSS24]. The iterative method has a main advantage of securing any precision (e.g., [BCC+22]) which may be necessary for a modular reduction framework described hereafter. In the case where coefficient-encoding RLWE ciphertext

t e 0 0 t 120 120 encodes message m∈at an upper bit, lowest-level scaling factor. Δmay be set to q/The lowest digit number may be extracted sequentially. First, the processormay multiply ct by.to obtain a CKKS ciphertext encoding [m]at the most significant bit. The processormay bootstrap the ciphertext (using integer-to-integer bootstrapping of [BKSS24]) to obtain

t 0 t 120 120 120 encoding [m]. The processormay extract a lowest coefficient of ct from lowest modulus. q, and deduct the lowest coefficient from an original ciphertext ct. In this process, the processormay obtain a slot-encoding CKKS ciphertext encoding a lowest digit number of m and a coefficient-encoding RLWE ciphertext encoding all the remaining digit numbers (i.e., (m−[m])/t) at an upper bit. In one embodiment, the processormay repeat this process to extract all the digit numbers and combine the extracted digit numbers.

120 In the case where high-precision MSB bootstrapping with respect to discrete data is given, the processormay use modulus switching to obtain real number-to-real number bootstrapping. For example, in the case where the modulus switching is performed with small modulus, the processor may convert the ciphertext into a discrete-CKKS ciphertext. In other words, in the case where existing coefficient-encoding CKKS ciphertext

N/2 0 0 0 120 encodes vector {right arrow over (z)}∈[−1, 1]to scaling factor Δ=q, changing this to modulusand returning to qmay be deemed to discretize the ciphertext, and a small error at the least significant bit may be allowed. For example, an output ciphertext encodes plaintext m∈and this may be approximatelyThe processormay use interative MSB bootstrapping to bootstrap the ciphertext.

A new homomorphic modular reduction method in the disclosure may use MSB bootstrapping (of large-scale precision) as a subroutine.

In the case where slot-encoding RLWE ciphertext

N/2 120 120 120 0 0 0 q0 q0 1 1 encodes message {right arrow over (z)}∈, the processormay select base-level scaling factor Δas Δ=q. The processormay perform StC and [⋅]to obtain a coefficient-encoding RLWE ciphertext that encodes plaintext [z(X)]∈. Herein, the coefficient may be adopted from [Re(Z))or [Im (Z)]. The processormay apply MSB bootstrapping to restore modulus, and obtain desired modulus reduction. This method may be operable in both of the discrete data and approximate data.

0 In the case of an existing CKKS bootstrapping method, a certain amount of gap is required between base modulus and a message to homomorphically approximate a modular reduction function, and in this case, bootstrapping instances may cause additional modulus consumption in the bootstrapping process as well as failure in supporting the modular reduction. In particular, as the size of a message increases through the process of ModRaise (e.g., from m to m+qI), greater module tends to be used for each bootstrapping (e.g., [Cry22]), and considering that modulus is a very restricted resource in homomorphic encryption, deterioration in performance may be caused.

In other words, it is important to find efficient MSB bootstrapping (additionally, necessary for a modulus reduction framework), but conventionally, most significant bit (MSB) bootstrapping is dealt with partially in [BGJ20], but an existing definition of bootstrapping is not encompassed properly.

120 In the disclosure, MSB bootstrapping may be generalized. First, the biggest obstacle of discrete bootstrapping of [BKSS24] is that complexity in calculation increases exponentially as bit precision increases. To solve the problem, an iterative method like [BCC+22, BZP+23] may be adopted to support high-precision discrete bootstrapping efficiently in the disclosure. Additionally, the processormay expand (raise) modulus up to MSB bootstrapping with respect to a real number through a modulus switching step at the lowest modulus. By doing so, according to the disclosure, a complete MSB bootstrapping framework may be provided.

1 All existing approaches [CHK+18, LLL+21, JM22, LLK+22, HMWW24] depend on polynomial approximation in homomorphic modular reduction using CKKS. In other words, to approximate Modfunction over section [−k, k], a degree of an approximation polynomial may be approximately proportional to k. To see this, the root of a polynomial (the number of integer points) with k as a degree is counted, and the number is 2k+1. In this context, homomorphic modular reduction in a wide section may require a great amount of computation, and in some cases, may be impossible.

120 Regarding this, the modular reduction method of the disclosure may be independent from an input section [−k, k]. For example, the processormay use an original modular reduction function itself independent from the input section, rather than approximating a modular reduction function in an existing wide section [−k, k]. By doing so, modular reduction may be provided very efficiently in a wide section in the disclosure.

Better Discrete Function Evaluation from Discretization

120 120 Modulus conversion at the lowest modulus may enable discretization of a coefficient-coding CKKS ciphertext to a coefficient-coding discrete CKKS ciphertext. By doing so, the processordiscretize an ordinary CKKS ciphertext, and then use a discrete-CKKS method. The discrete CKKS may support any function evaluation based on a look-up table like [CKKL24] and this may be an advantage deemed to be more importance than that of existing CKKS. Additionally, the processormay bit-decompose a CKKS ciphertext with a framework of [BKSS24], and this may provide an alternative solution with respect to a comparison-like function.

A look-up table-based approach enables a rapid evaluation of many functions that are hardly approximated. For example, an exponential function as a non-polynomial function, a reciprocal, a square root, ReLU and the like may be evaluated in this way. Such functions may be necessary for machine learning that is one of the fields in which homomorphic encryption is used mainly. Additionally, the method may be deemed as a similar thing of quantization, and produce the effect of lowering calculation costs by reducing a base data type of a message.

A bit-decomposed CKKS ciphertext may be used to accelerate a comparable similar function such as argmax and sorting. Since an existing homomorphic comparison approach uses polynomial approximation, big multiplication depth and time are required for an evaluation, and a function including homomorphic comparison as a subroutine may be very expensive. On the contrary, comparison of bit-decomposed ciphertexts may be relatively inexpensive, and based on the comparison, a more complex function such as argmax and sorting may be established.

16 4 FIG. 4 FIG. The subject matter of the disclosure may be implemented based on a C++ HEaaN library [Cry22]. All experiments were conducted at a single thread CPU and are implementable as surplus number degree N=2.is a view illustrating a summary of performance of iterative MSB bootstrapping and homomorphic modular reduction with respect to integers and real numbers according to one embodiment. In, high-precision iterative MSB bootstrapping (respectively homomorphic modular reduction) using an input/output of 15 bits is expressed as IntBoot (respectively IntMod), and iterative MSB bootstrapping (respectively homomorphic modular reduction) using a real-number input is expressed as Boot (respectively Mod).

Additionally, a new bit decomposition method using a framework of the disclosure was compared with a method suggested by Drucker et al. [DMPS24]. According to the disclosure, 10-bit decomposition that is 7.1 times faster than the method suggested by Drucker et al. [DMPS24] may be secured while precision is maintained.

N/2 N/2 N/2 The message space of an existing CKKS [CKKS17] is, and the message space may be described as approximate data. [DMPS24] may adopt embedding toand use a discrete message space. For example, {0,1} bit may be embedded intobased on identity embedding. One of the main differences between approximate CKKS and discrete CKKS is that the discrete CKKS has a “cleaning” concept of removing noise of a base plaintext. To improve the efficiency of embedding, [CKKL24] adopted root-of-unity embedding and explored multivariate interpolation.

Research into modular reduction as one of the main steps of CKKS bootstrapping called EvaMod was widely conducted throughout CKKS documents [CHK18, LLL21, JM22, LLK22], but could be evaluated only with respect to a small range (e.g., 25 cycles) due to a limitation (see [HMWW24]) of polynomial approximation. Regarding this, according to the disclosure, an inherent modular reduction function inherent in RLWE may be used. In studies [KDE24, CCKS23], such a function was used to establish a partial function in a CKKS scheme, but modular reduction was not integrated into the main computation of CKKS. One of the essential technologies for enabling efficient modular reduction may be most significant bit (MSB) bootstrapping, and may enable bootstrapping a ciphertext having no gap with modulus. Existing MSB bootstrapping [BCKS24, BGGJ20, BKSS24] does not provide efficient bootstrapping with respect to real numbers that can allow modular reduction. In the disclosure, to solve the problem, iterative bootstrapping (see [BCC+22, BZP+23]) was used, while modulus conversion was used properly.

N Q >0 q In the case of=[X]/(X+1) and=/Qwith respect to Q∈when N is integers that are powers of 2, [m]may be modular reduction of which an output value belongs to (−q/2, q/2] and has a symbol (sign) with respect to m∈.

Q When secret key sk∈is given in the case where m∈is a plaintext, RLWE ciphertext ct encoding m may satisfy [ct·sk]=m in a pair of

N N/2 In the case where m(x)∈is a plaintext, while Δ∈is a scaling factor, DFT: R[X]/(X+1)→may be defined as follows.

1 5 1 N/2 Herein, ξ=ξrelates to 2N-degree root-of-unity ξ, and decryption map Dcd:→Cmay be defined as follows.

N/2 N N/2 In the case where iDFT:→[X]/(X+|1) is a reciprocal of DFT, encoding map Ecd:→may be defined as follows

N/2 N/2 Encoding and decoding may provide a response between R and, and by doing so,may be used as a message space of the RLWE ciphertext.

In the case where

N/2 is a CKKS ciphertext encoding {right arrow over (z)}∈by using scaling factor Δ, rescaling ct to q|Q may be defined as follows.

This may reduce the scaling factor from Δ to Δ/q.

120 1. Slot-coefficient conversion (Slots-to-Coefficients, StC): DFT may be evaluated to covert a ciphertext encoding message {right arrow over (z)} homomorphically to a ciphertext encoding plaintext z(x) of which coefficients are slots of {right arrow over (z)}. 2. Modulus raising (ModRaise): in the case where coefficient-encoded ciphertext Modulus of the CKKS ciphertext may be decreased while going through homomorphic computation. To restore the modulus, the processormay perform bootstrapping of increasing the modulus while preserving a base message in an approximate manner. Existing CKKS bootstrapping [CHK+18] is operated as follows.

0 t 0 2 3. Coefficient-slot conversion (Coefficients-to-Slots, CtS): iDFT may be evaluated homomorphically to convert a ciphertext encoding plaintext m(x) to a ciphertext encoding message {right arrow over (m)} Herein, {right arrow over (m)} may be a coefficient of m(x). 0 0 4. Approximate Modular Reduction (EvalMod): To remove a small multiple of qintroduced during ModRaise, a modular reduction function may be approximated and evaluated. Ordinarily, using a polynomial approximating partial trigonometric functions may be selected. Since continuity of approximate modular reduction is required, a gap may be required between message m and base modulus qduring ModRaise. encoding plaintext m(x)∈in lower-end module qis given, this may be embedded intowith respect to greater Q, in other words, this may be embedded intobased on embedding of→and modulo Q may be adopted. From the perspective of plaintext m, this involves changing m to m+qI of, and herein, I may be a small-integer polynomial of R.

In [DMPS24], an integer vector was regarded as a complex number vector to calculate discrete data, and ordinary CCKS encoding was used to encode integers directly. The advantage of such encoding is that arithmetic computation such as addition and multiplication may be naturally inherited from the attribute of homomorphism of CCKS.

t φ 2π2x/t t-1 2π2/t Another type of encoding as root-of-unity encoding suggested by [CKKL24] may concentrate on a primitive t-th root of unity with respect to certain t, and see.as the idea of xe:t→As described in [CKKL24], the root-of-unity provides a numerically reliable look-up table evaluation, and this may mean that a precise evaluation is provided with respect to any function φ:{1, ω, . . . , ω}→. Herein, ω=emay be a primitive t-th root of unity, and hereafter, a homomorphic evaluation of φ is expressed as LUT.

0 ModRaise: Δ=q/2 is set such that a bit is disposed at the most significant bit of ciphertext In [BCKS24], CCKS bootstrapping is applied in accordance with bit encoding {0,1}, and bootstrapping is enabled with no gap between a message and base modulus, to reduce modulus consumption. To this end, CCKS modified ModRaise and EvalMod.

EvalMod: An approximate modular reduction function is replaced with trigometric function

to obtain. f(b/2+I)=b. Herein, b∈{0, 1}, I∈.

This refer to such new bootstrapping as BinBoot, and BinBoot may include not only bootstrapping a bit rightly but also partial cleaning [BCKS24, Theorem 1].

2πix In [BGGJ20], yet another bootstrapping of CCKS using complex exponential xeis described in the process where conversion from CGGI to CCKS is described (Section 4.1). At a time when an integer coefficient-encoded CCKS ciphertext is limited to a lower level, bootstrapping thereof may be interpreted as bootstrapping from an integer encoding state to a root-of-unity encoding state.

For example,

2 e2πix 2πxm/t may be a ciphertext encoding the most significant bit of plaintext mER together with a scaling factor of size q/t. This may be regarded as encoding. (q/t)m+qI (a certain small I∈R), and herein, ct may be deemed to be a ciphertext of(=ModRaise). Then the scaling factor is set as q, and complex exponential xmay be evaluated homomorphically. This may involve mapping m/t+I as, eand essentially, may involve converting integer encoding into root-of-identity encoding.

In the case of existing bootstrapping, a gap may be required between a message and base modulus to approximate modular reduction. Hereafter, an existing (discrete) bootstrapping method requiring no gap and an iterative bootstrapping algorithm of improving precision efficiently are described. Additionally, a method of bootstrapping real numbers at the most significant bit is described hereafter.

0 0 t N/2 2πix/t 0. Parameter Setting: Input and output ciphertexts both encode an integer-encoding message in a slot-encoding state. Each integer of the message belongs to (−t/2, t/2] to avoid an overflow. The lowest-level scaling factor is set to Δ=q/t, such that the message is encoded at the most significant bit. ψ:=(−t/2, t/2┘→is defined as ψ(x)=e, and this is an idea relating to root-of-identify encoding. 1. Slots-to-Coefficients: Put a slot into a coefficient. 2. Modulus-Raising: Increase modulus like existing CCKS bootstrapping. 3. Coefficients-to-Slots: Put the coefficient to the slot again. 2πix 4. Homomorphic Exponential: Complex exponential xeis evaluated homomorphically, and like [BGGJ20], an integer is sent to a root of unity. This process is referred to as EvalExp. −1 ψ −1 5. Homomorphic ψ: To restore the integer from the root of unity to an integer again, a reciprocal of ψ is evaluated homomorphically. This process may be referred to as LUT. First, an existing bootstrapping method for discrete data calculation is described again. For example, integers are combined with root bootstrapping of [BGGJ20], and a framework of [CKKL24] is used to perform an evaluation of an integer-root look-up table, thereby configuring efficient integer-to-integer bootstrapping at the most significant bit. This structure may also be deemed to be generalization of BinBoot of [BCKS24]. The bootstrapping may be outlined as follows.

t ψ −1 t t 5 FIG. Hereafter, such bootstrapping is referred to as IntBoot, and this is described in detail with reference to algorithm 1 of. The accuracy of the bootstrapping may be directly seen based on the elements thereof EvalExp and. LUT, and this is independently verified in [BGGJ20] and [CKKL24] respectively. As a method corresponding to HalfBoot of [CHK+21]. IntBootwithout a first step StC is described as. HalfIntBoot, hereafter.

ψ −1 2πix The implementation of StC, ModRaise, CtS, and. LUTmay be simple, and a latest method may be used with respect to each computation. On the contrary, in relation to the implementation of EvalExp, a tailor expansion of complex exponential xefrom 0 is used in [BGGJ20], and this is certainly operable but is not numerically reliable and cause deterioration in efficiency.

120 t The processormay perform iterative bootstrapping based on IntBoot.

120 For example, the processormay extract the least significant figure by using

t IntBoot, and repeat the extractiontimes, to obtain boorstrapping with respect to a plaintext space of size.. Entire bootstrapping is referred to as

6 FIG. and a detailed algorithm is the same as algorithm 2 of.

120 120 120 120 120 t The processormay start with sufficiently precise StC and dispose a message from a slot to a coefficient at (−/2, t/2). Multiplication bymay be extracting the least significant figure. Accordingly, the processormay use HalfintBootas a subroutine, and output a slot-encoded ciphertext encoding the least significant figure. The processormay perform StC, and deduct StC from a coefficient-encoded original ciphertext, to obtain ciphertext (t→) having a one-digit less figure. The processormay extract all figures and repeat the extraction until the figures are stored in upper modulus. The processormay combine all the figures in a linear combination, to restore an entire message. Since

t t requirestimes of HalfintBootandtimes of StC, costs may be incurred as much as the costs oftimes of IntBoot,

120 The processormay generalize IntBoot and configure bootstrapping with respect to real numbers.

is defined as modulus conversion, and this is conversion from q to q′, and if necessary, may be expanded to

120 with respect to k≥1. For example, the processormay set the modulus conversion asand discretize a real-number message to a discrete message.

In the case where

12 120 0 0 0 2 is a slot-encoded CCKS ciphertext which encodes plaintext m and of which a slot is (−1/2, 1/2], the processormay set the lowest-level scaling factor to Δ=qafter StC such that m is in a coefficient of the most significant bit. The processormay modulus-switch the ciphertext towith respect to t,≥1 selected properly, and modulus-switchto qagain, such that the . . . is compatible with

120 The processormay apply

to complete our bootstrapping. Since the modulus switching is an identity function fundamentally, the modulus switching may provide bootstrapping having precision of aboutwith respect to ct. Hereafter, such bootstrapping is expressed as

7 FIG. and a detailed algorithm is suggested in algorithm 3 of.

may be operated up to modulo 1. In other words, −1/2 is deemed to be the same as 1/2, and a message close to −1/2 may be bootstrapped to be close to 1/2, or vice versa. At a time of configuring homomorphic modular reduction and bit decomposition, bootstrapping with respect to modulo 1 is enough. If accurate bootstrapping ensuring accuracy without the condition of “up to modulo 1” is required, an error may be restored based on deduction and bootstrapping, such that this is processed.

Referring back to algorithms 2 and 3 to find different versions of

1 ( one additional bit extraction step may be added with respect to each ct0≤i<).

j t-1 th First, the way of extracting a bit from roots of unity may be defined as extracting l: {1, ω, . . . , ω}→{0, 1} from a jlowest bit from of a coefficient. Herein, this may be 0≤j<t.

ij Evaluating LUTwith respect to each j may provide all bits of the roots of unity.

i ij ψ −1 t t 120 If LUTis defined as executing. LUTon all js and outputting t numbers of ciphertexts encoding bits of an initial ciphertext respectively, the processormay replace LUTof algorithm 1 with the LUT, and obtain a bit extraction version of IntBoot, and this may be naturally expanded to

A bit extraction of a ciphertext may be useful at a time when discrete functions are calculated, and in particular, may be useful in the case where complex discrete functions need to be comprised of simpler discrete functions as a subroutine.

t Bit decomposition with respect to a CKKS ciphertext is already suggested in [DMPS24, Algorithm 3]. If t is fixed, while our parameteris deemed as an analogue of N in their algorithms, their algorithms may be described as iterating a homomorphic sign function of O() bit precision O() times. According to [CKK20, Theorem 1], the sign function of O() bit precision consumes an O() multiplication depth at an optimal depth. On the contrary, depth consumption of IntBootis irrelevant to. Accordingly, an algorithm of the disclosure may be described as evaluating circuitry of depth O(1)times, and may be much better than this asymptotically.

120 0 0 0 Modular reduction of CKKS ciphertexts encoded with a coefficient may provide modular reduction with respect to base plaintexts thereof. In the case where the modular reduction is applied, the processormay use the above-described bootstrapping method to restore modulus. Hereafter, qas base modulus, Q bootstrapping output modulus, and q as any CKKS modulus between qand Q are described as becoming qor Q for convenience.

For simplification, in the case where a modulo 1 function for CKKS (with a symbol (sign)) is suggested, reduction caused by any modulo (modular) may be readily configured with proper constant multiplication.

0 q Based on homomorphic modular reduction of the disclosure, [⋅]qmay be readily performed with respect to a ciphertext of any CKKS modular. For example, at a time when message m∈is encrypted,

may encrypt message

with respect to

q0 1 Additionally, based on homomorphic modular reduction of the disclosure, [⋅]may be approximately used as a proper scaling factor to calculate [⋅]. For example,

may be with respect to z∈, and herein, this may be

q0 In other words, since . . . may be expanded to/with any modulo (modular), any modular reduction using. [⋅]may be possible.

N/2 0 StC 0 0 q0 1 0 120 120 may be a slot-encoded CKKS ciphertext at modules q. {right arrow over (z)}∈may be encrypted, and StC may be set as qin OG as a scaling factor after StC. The processormay limit modulus of ct to perform StC, and then perform StC with following scaling factor Δ. In this case, output ciphertext ct′ may be a ciphertext at modulus q, and the ciphertext may encode q. {right arrow over (z)} in a coefficient. That is, in the case where [⋅]is performed with respect to ct′, a ciphertext of based modulus may be obtained, and may be a result of encoding [{right arrow over (Z)}]at the most significant bit (MSB). The processorraise modulus from qto Q by using

8 FIG. to maintain a main bit. Detailed description in relation to this is provided with reference to algorithm 4 of.

A number of studies [CHK+18, LLL+21, JM22, LLK+22] of modular conversion function computation of base modulus have already been performed homomorphically. The modular conversion function computation is an essential subroutine in CKKS bootstrapping, but existing methods may not be used as a ciphertext modular reduction function since this is operated in a limited section. In greater detail, existing bootstrapping methods perform modular reduction by using a polynomial approximate sign function with respect to continuous data, and are only appropriate for approximation near a small integer. Additionally, a LUT size caused by a difference between a message size and base modulus is inefficient.

On the contrary, in the homomorphic modular reduction method of the disclosure, data may be discretized based on modulus switching first, and then calculated with a root-of-unity encoding-based LUT. In other words, the LUT may match a modular reduction function in an entire section uniformly distributed with respect to a discrete input, and accordingly, the modular reduction in the entire section may be performed homomorphically with high precision and efficiency, thereby avoiding a waste of memory.

One of the direct and important applications may be homomorphic rounding. Deducting an output of

from an original ciphertext may correspond to a homomorphic floor function. In the case where normalization is used, a homomorphic rounding function may also be obtained. The homomorphic rounding may be simple but an important step function, and based on proper normalization, may be expanded to more step functions such as a sign function and the like. A previous step function calculation method [HMWW24] involves performing approximation by using a massive-scale polynomial, causing a problem such as inefficiency in the case of a wide input range, and a growing number of computation steps. Unlike a previous method, the homomorphic rounding of the disclosure is advantageous in that computation complexity may be irrelevant to an input range, and that the homomorphic rounding may be performed at the same time as bootstrapping is performed in the way that the homomorphic rounding is hidden during the bootstrapping. In other words, the homomorphic rounding and the bootstrapping may be processed at the same time.

As an integer adaptive version of

t e IntModusing

9 FIG. t t t (t t ) tm1, . . . x 1 to adopt modulomay be defined with respect to Gaussian integers, and detailed descriptions in relation to this are provided with reference to algorithm 5 of. HalfIntBoot may be slightly modified to respectively perform HaifintBootonce with respect to i=1, . . . ,rather than performing HalfIntBoottimes, and defined as. IntModadopting a modulo of a Gaussian integer with respect to modulus. t. . .. This may be useful when integer modular reduction is calculated with respect to modulus having a large number of prime factors. Additionally, there may be

that are bit decomposition versions respectively in

Bootstrapping using Modular Reduction

The bootstrapping method in the case where a message is at the most significant bit may enable bootstrapping after integers or real numbers are placed at the most significant bit properly based on multiplication of base modulus by a constant. Hereafter, a bootstrapping method of integrating bootstrapping into a homomorphic modular reduction framework, and bootstrapping an ordinary CKKS ciphertext having fixed parameters

120 The processormay use

to perform modular reduction of a decimal portion, regard the remaining portions as big integers, and useto repeat bootstrapping. The bootstrapping is expressed as

10 FIG. and a detailed algorithm is illustrated in algorithm 6 of. A CKKS ciphertext of which the decimal portion islog t bit, and the integer portions are (k−1)log t is only described, but proper normalization for adjusting the sizes of the decimal portion and the integer portions may be possible.

Additionally, a bit-decomposition analogue of

outputting all klog t bits rather than the entire ciphertext may also be possible. An output of this sort may be useful to evaluate a discrete function, and this is because using a bit is often more efficient than using am approximate value with respect to an ordinary real number.

may require one

and k−1 numbers of, and each algorithm may require one StC and one

requires k numbers of

and k numbers of StC, costs may be incurred by k numbers of

t or kumbers of IntBoot.

Modulo Small Integer Arithmetic with CKKS

In the case where efficient homomorphic modular reduction

>0 m is used, modulo m computation with respect to m∈may be naturally configured in CKKS. In CKKS,computation is configured in [DMPS24, Section 8.1], and since this depends on expensive bit decomposition, this is extremely inefficient, but according to the disclosure, natural modular reduction of a RLWE ciphertext may be used, thereby incurring costs of a maximum k numbers of BinBoot with respect to precision parameter k.

m It may be meant that modular reduction using a strategy different from that of [DMPS24] with respect tocomputation is more preferable than the modular reduction lazily performed according to the disclosure. Costs of homomorphic modular reduction suggested in [DMPS24] may vary depending on the size of input data, but the algorithm of the disclosure may not be the case.

The framework of the disclosure may provide a method of discretizing a message. In other words, with respect to a given CKKS ciphertext encoding real numbers, a ciphertext encoding integers or bits may be output. This may be helpful to better evaluate a discrete function deemed as a main problem in CKKS.

For example, the framework of the disclosure may provide bit decomposition of a CKKS ciphertext, and establish a discrete function such as comparison, a maximum value, sorting more efficiently.

24 Unlike a previous approach, the subject matter of the disclosure is advantageous in outputting only a result discretized all the time without an intermediate value. In the case where a polynomial approximate value is used, a polynomial may not avoid the occurrence of an intermediate output on a boundary case since the polynomial is continuous, but the subject matter of the disclosure depends on converting into discontinuous modulus., thereby making it possible to discretizing any real number completely.

1. Approximate CKKS→Discrete CKKS 2 . Analogue of the quantization in Machine Learning

N/2 2 1 2 ∞ avg m w 11 FIG. The subject matter of the disclosure was developed on a C++ HEaaN library, and all the experiments and measurement were performed at single thread CPU, 512 GB RAM, 2.8 GHZ Intel Xeon Gold 6242 using Ubuntu 20.04.5 LTS as an operating system. For the experiments, a new parameter having 128-bit security was configured, and average precision and worst precision with respect to e∈that is a difference between the message of an output ciphertext and the message of an input ciphertext were measured. The average precision and the worst precision may be −log(∥e∥) and −logmax∥e∥respectively. Additionally, average execution time according to the disclosure was measured. All the experiments were performed repeatedly 100 times or greater. T, Pand Pmay indicate the average execution time, the average precision, and the worst precision respectively, and are illustrated in.

t 120 According to the disclosure, repetitive bootstrapping was implemented based on IntBootof which t equals 32, and repetitive timesmay vary from 1 to 4 to measure the average and worst precision and the execution time. The processormay bootstrap normalized integers rather than integers. For example,

N/2 may bootstrap a ciphertext encoding a vector that is {n/|n∈[0,∩}. Accordingly, precision may mean the number of bits preserved from the most significant bit (MSB) of an input message.

Additionally, according to the disclosure, repetitive bootstrapping of a normalized version with respect to real numbers was implemented as

This may maintain the above-described settings without changing the settings by using

as a subroutine.

N/2 may bootstrap a ciphertext encoding vector {right arrow over (e)} that is {right arrow over (e)}∈[0, 1). Since

is operated as (with) modulo 1, as modulo 1 error may be measured in the case.

Precision of repetitive bootstrapping may not depend onand may be actually sufficiently high. However, precision of repetitive real-number bootstrapping increases asincreases, and may differ from that of the repetitive bootstrapping. In the disclosure, since an input ciphertext is discretized based on modulus switching before halfIntBoot, the subject matter of the disclosure may be reasonable, and precision may not be greater than log. In other words, the size of an error may be increased because of discretization at a time of multiplication of a secret key in decryption, and the precision of the repetitive real-number bootstrapping may be slightly less than log. Execution time of both

t t t 12 FIG. may betimes greater than IntBootand Bootsince halfIntBootin the algorithms is performedtimes, but measurement time may be slightly less than expected since StC is performed only once regardless of, and a result thereof is illustrated in.

According to the disclosure, modular reduction and bootstrapping may be performed together at the same time. For example, in the case where an input ciphertext encodes a message

1 2 N/2 N/2 may output a ciphertext encoding [{right arrow over (z)}+{right arrow over (e)}]∈together with greater modulus. Average and worst precision may be defined as usual by using error {right arrow over (e)}∈, and unlike that of an existing one, the precision may vary depending on the size of an integer portion of an input vector. In other words, according to the disclosure, bit length of the size of the input vector is expressed as log[z], and the bit length may be changed in various ways, and

t e was used as a subroutine, to implement IntModthat is an integer version of

as a real-number bootstrapping method using

t e and IntModwas implemented, and a result based on

13 FIG. 14 FIG. t e is illustrated in, a result based on IntModis illustrated in, and a result based on

15 FIG. is illustrated in.

A bit decomposition method using a frame work of the disclosure is compared with a latest bit decomposition method using an approximate sign function as a subroutine, suggested in [DMPS24].

N/2 th i 0≤i<k i i In the case of k-bit decomposition, both the two methods may receive a ciphertext ct encoding message {right arrow over (z)}∈[0,1)as an input. Additionally, in these methods, a ciphertext vector of (ct)is output, and herein, ctmay encode ibit vector {right arrow over (b)} of {right arrow over (z)} with respect to each slot.

Two types of errors may be used to compare the two methods. A first error may indicate how close is an output message to 0 or 1. The first error is defined as

and herein, . . . may be

fail In relation to this, failure probability pmay be defined as (with) an elemental ratio of vector

−k −k th exceeding 2. The definition may be natural since error 2affects the extraction of a kbit at the MSB, causing inaccurate decomposition. A second error may indicate how accurately bit decomposition is performed. As

are defined, a result of a rounded output vector was used to calculate the second error, such that the first type of error may be ignored at a time of calculation of the second error.

16 FIG. Further, 10-bit decomposition was used to compare the two methods, and in implementing the bit decomposition method explained by Drucker et al. ([DMPS24]), a parameter having an identical RLWE degree and identical multiplication depth was used to secure fair comparison. Details of the parameter are provided in. A homomorphic sign function suggested by Cheon et al. ([CKK20]) was used, and in detail, an approximate sign function obtained by synthesizing seventh-degree polynomial

17 FIG. six times was used, and a result thereof is illustrated in.

The method of the disclosure is 7.1 times faster than an existing one while maintaining precision, and an existing technology may have 1.00% probability of failure due to an approximation error of a homomorphic sign function, while the method of the disclosure may have 0.00% probability of failure that is ignorable.

18 FIG. is a flowchart provided to explain a control method of an electronic apparatus according to one embodiment.

1810 1820 1830 1840 1850 1860 First, a Cheon-Kim-Kim-Song (CKKS) ciphertext encoding a real-number message in a predetermined discrete value set is obtained (S). Additionally, SlotToCoeff computation of converting the real-number message into a coefficient expression is performed (S). Additionally, based on modulus switching computation with respect to the ciphertext converted into a coefficient expression, discretization of approximating the real-number message converted into a coefficient expression to a closest value in the predetermined discrete value set is performed (S). Additionally, modulus raising computation of raising modulus to an upper level with respect to the discretized ciphertext is performed (S). Additionally, CoeffToSlot computation of converting the ciphertext of which modulus is raised into a slot-encoded message is performed (S). Additionally, based on EvalMod computation, modular reduction at the same time as rebooting computation ends with respect to the slot-encoded ciphertext is performed (S).

1830 Additionally, the performing discretization (S) may include converting first modulus into second modulus lower than the first modulus with respect to the ciphertext converted into a coefficient expression, and restoring the second modulus to the first modulus to perform discretization.

Additionally, the method may further include performing the discretization to obtain an output message in the predetermined discrete value set.

Additionally, the method may further include performing computation with respect to the output message through a look-up table without polynomial approximation at a time of additional function computation.

Additionally, the method may further include performing bit decomposition with respect to the output message to perform discrete function computation with respect to the output message.

Additionally, the method may further include transmitting the output message to a server.

Additionally, the method may further include displaying the output message.

Further, a scaling factor of the real-number message may be maintained at a first modulus value while the modular reduction is performed.

[BCC+22] Y. Bae, J. H. Cheon, W. Cho, J. Kim, and T. Kim. META-BTS: Bootstrapping precision beyond the limit. In CCS, 2022. [BCKS24] Y. Bae, J. H. Cheon, J. Kim, and D. Stehl'e. Bootstrapping bits with CKKS. In EUROCRYPT, 2024. [BGGJ20] C. Boura, N. Gama, M. Georgieva, and D. Jetchev. CHIMERA: Combining ring-LWE-based fully homomorphic encryption schemes. J. Math. Crypt., 2020. [BGV12] Z. Brakerski, C. Gentry, and V. Vaikuntanathan. (Leveled) fully homomorphic encryption without bootstrapping. In ITCS, 2012. [BKSS24] Y. Bae, J. Kim, D. Stehl'e, and E. Suvanto. Bootstrapping small integers with ckks. In ASIACRYPT, 2024. To appear, available upon request from the authors. [Bra12] Z. Brakerski. Fully homomorphic encryption without modulus switching from classical GapSVP. In CRYPTO, 2012. [BZP+23] S. Bian, Z. Zhang, H. Pan, R. Mao, Z. Zhao, Y. Jin, and Z. Guan. HE3DB: An efficient and elastic encrypted database via arithmetic-and-logic fully homomorphic encryption. In CCS, 2023. [CCKS23] J. H. Cheon, W. Cho, J. Kim, and D. Stehl'e. Homomorphic multiple precision multiplication for CKKS and reduced modulus consumption. In CCS, 2023. [CGGI16] I. Chillotti, N. Gama, M. Georgieva, and M. Izabach'ene. Faster fully homomorphic encryption: Bootstrapping in less than 0.1 seconds. In ASIACRYPT, 2016. [CHK+18] J. H. Cheon, K. Han, A. Kim, M. Kim, and Y. Song. Bootstrapping for approximate homomorphic encryption. In EUROCRYPT, 2018. [CHK+21] J. Cho, J. Ha, S. Kim, B. Lee, J. Lee, J. Lee, S. Moon, and H. Yoon. Transciphering framework for approximate homomorphic encryption. In ASIACRYPT, 2021. [CKK+19] J. H. Cheon, D. Kim, D. Kim, H. H. Lee, and K. Lee. Numerical method for comparison on homomorphically encrypted numbers. In ASIACRYPT, 2019. [CKK20] J. H. Cheon, D. Kim, and D. Kim. Efficient homomorphic comparison methods with optimal complexity. In ASIACRYPT, 2020. [CKKL24] H. Chung, H. Kim, Y.-S. Kim, and Y. Lee. Amortized large look-up table evaluation with multivariate polynomials for homomorphic encryption. IACR eprint 2024/274, 2024. [CKKS17] J. H. Cheon, A. Kim, M. Kim, and Y. Song. Homomorphic encryption for arithmetic of approximate numbers. In ASIACRYPT, 2017. [Cry22] CryptoLab. HEaaN library, 2022. Available at https://heaan.it/. [DM15] L. Ducas and D. Micciancio. FHEW: Bootstrapping homomorphic encryption in less than a second. In EUROCRYPT, 2015. [DMPS24] N. Drucker, G. Moshkowich, T. Pelleg, and H. Shaul. BLEACH: Cleaning errors in discrete computations over CKKS. J. Cryptol., 2024. [FV12] J. Fan and F. Vercauteren. Somewhat practical fully homomorphic encryption. Cryptology ePrint Archive, Paper 2012/144, 2012. [HMWW24] T. Huang, S. Ma, A. Wang, and X. Wang. Approximate methods for the computation of step functions in homomorphic encryption. Cryptology ePrint Archive, Paper 2024/171, 2024. [JM22] C. S. Jutla and N. Manohar. Sine series approximation of the mod function for bootstrapping of approximate he. In EUROCRYPT, 2022. [KDE+24] A. Kim, M. Deryabin, J. Eom, R. Choi, Y. Lee, W. Ghang, and D. Yoo. General bootstrapping approach for RLWE-based homomorphic encryption. IEEE Transactions on Computers, 2024. [LLK+22] J.-W. Lee, Y. Lee, Y.-S. Kim, Y. Kim, J.-S. No, and H. Kang. Highprecision bootstrapping for approximate homomorphic encryption by error variance minimization. In EUROCRYPT, 2022. [LLKN22] E. Lee, J.-W. Lee, Y.-S. Kim, and J.-S. No. Optimization of homomorphic comparison algorithm on RNS-CKKS scheme. IEEE Access, 2022. [LLL+21] J.-W. Lee, E. Lee, Y. Lee, Y.-S. Kim, and J.-S. No. High-precision bootstrapping of rns-ckks homomorphic encryption using optimal minimax polynomial approximation and inverse sine function. In EUROCRYPT, 2021. [LLNK22] E. Lee, J.-W. Lee, J.-S. No, and Y.-S. Kim. Minimax approximation of sign function by composite polynomial for homomorphic comparison. IEEE TDSC, 2022. [LW24] Z. Liu and Y. Wang. Relaxed functional bootstrapping: A new perspective on bgv/bfv bootstrapping. Cryptology ePrint Archive, Paper 2024/172, 2024.

According to the above embodiments, the electronic apparatus may also perform modular reduction on a real-number message based on discretization.

Meanwhile, the embodiments described above may be implemented with software including instructions stored in a storage medium readable by a machine (e.g., a computer). The machine, as a device capable of calling the stored instructions from the storage media and operating according to the called instructions, may include the electronic apparatus (e.g., electronic apparatus A) according to the disclosed embodiments. Based on instructions executed by a processor, the processor may perform functions corresponding to the instructions directly or by using other elements under the control of the processor. The instructions may include a code generated or executed by a compiler or an interpreter. The machine-readable storage medium may be provided in the form of a non-transitory storage medium. Herein, the term “non-transitory” means that the storage medium does not include a signal and only means that the storage medium is tangible, while the term does distinguish semi-permanent or temporary storage of data in the storage medium.

Additionally, according to the embodiments described above, the method may be provided in a computer program product. The computer program product may be exchanged between a seller and a purchaser as a commodity. The computer program product may be distributed in the form of a machine-readable storage medium (e.g., compact disc read only memory (CD-ROM)) or distributed online through an application store (e.g., Play Store™). In the case of online distribution, at least part of the computer program product may be stored at least temporarily, or generated temporarily in a storage medium such as a manufacturer's server, a server of an application store, or memory of a relay server.

Additionally, the embodiments described above may be implemented in a recording medium readable by a computer or a device similar to a computer by using software, hardware or a combination thereof. In some cases, the embodiments set forth herein may be implemented as a processor itself. In the case of software implementation, the embodiments such as steps and functions set forth herein may be implemented as separate software. Each software may perform one or more functions and operations set forth herein.

Meanwhile, computer instructions for performing processing operations of a device according to the embodiments described above may be stored in a non-transitory computer-readable medium. The computer instructions stored in such a non-transitory computer-readable medium, when executed by a processor of a specific device, cause the specific device to perform the processing operations in the device according to the embodiments described above. The non-transitory computer-readable medium means a medium that stores data semi-permanently and is readable by a machine, rather than a medium such as a register, cache, memory and the like that store data temporarily. Specific examples of the non-transitory computer-readable medium may include a CD, a DVD, a hard disc, a blue-ray disc, a USB, a memory card, ROM, and the like.

Further, each of the elements (e.g., a module or a program) according to the embodiments described above may be comprised of a single entity or a plurality of entities, and some of the corresponding sub elements described above may be omitted, or another sub element may be further included in the embodiments. Alternatively or additionally, some of the elements (e.g., modules or programs) may be integrated into one entity to perform identical or similar functions performed by each corresponding element prior to integration. Operations performed by a module, a program, or another element, according to the embodiments, may be executed sequentially, in parallel, repetitively, or heuristically, or at least some of the operations may be executed in a different order, omitted, or may add a different operation.

While the example embodiments of the disclosure are illustrated and described above, embodiments of the disclosure are not limited to the embodiments set forth herein, and certainly, various modifications thereof may be made by those skilled in the art to which the disclosure pertains, without departing from the scope of the subject matter of the disclosure claimed in the section of claims, and are not to be understood as separating from the technical spirit or prospect of the disclosure.

[Description of Reference Numerals] 100: Electronic apparatus 110: Memory 120: Processor 200: Server